Consider the following .pkla files
/etc/polkit-1/localauthority/50-local.d/10-org.acme.pkla:
[Allow group staff to do org.acme.frobnicate]
Identity=unix-group:staff
Action=org.acme.frobnicate
ResultAny=yes
ResultInactive=yes
ResultActive=yes
and
/etc/polkit-1/localauthority/10-vendor.d/10-org.vendor.lockdown.pkla:
[Lock org.acme.frobnicate down]
Identity=unix-user:*
Action=org.acme.frobnicate
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_admin
where the former is provided by the 3rd party that provides the org.acme.frobnicate action (e.g. the software package) and the latter is provided by the OS vendor.
Because of the way .pkla files work, e.g.
1. First we run through .pkla files in order for Group identities
that the Subject in question belongs to
2. Then we run through .pkla files in order for the User identity
for the Subject in question
the latter always "win" even though the former has a higher priority. This is problematic because it's a semi-reasonable thing for the OS vendor to want to do.
One solution would be to allow "Identity=*" to mean any and then declare the order to be
0. First we run through .pkla files in order and apply any section
where Identity=*
1. First we run through .pkla files in order for Group identities
that the Subject in question belongs to
2. Then we run through .pkla files in order for the User identity
for the Subject in question
This way OS vendors can "lock down" everything without interfering with other .pkla files.
Another option is to completely rethink how the Local Authority is configured and do something a lot simpler. This might not be too late as we haven't hit 1.0 yet.
See https://bugzilla.novell.com/show_bug.cgi?id=544579 for a real-world example of where an OS vendor runs into this problem.

Crazy idea: Maybe a better setup than .pkla files would be to do things exactly like udev does - with rules
ACTION=="org.libvirt.manage", USER=="davidz", RESULT="auth_admin"
# /path/to/script can print RESULT=auth_admin|yes|no|... on stdout
ACTION=="org.libvirt.*", RUN="/path/to/script"
# allow mounting filesystems if in a local active session
ACTION=="org.udisks.mount", ACTIVE=="true", LOCAL=="true", RESULT="yes"
So we'd have and
/etc/polkit-1/localauthority/rules.d/
/var/polkit-1/localauthority/rules.d/
(same way udev has /lib/udev/rules.d and /etc/udev/rules.d - we'd also
include nice and useful semantics such as
Rule files are required to have a unique name, duplicate file names are
ignored. Files in /etc/udev/rules.d/ have precedence over files with
the same name in /lib/udev/rules.d/. This can be used to ignore a
default rules file if needed.
which is from the udev(8) man page.)
and, more importantly, this allows running scripts/programs to determine if the given Subject is authorized or not. Which basically makes the PolicyKit Local Authority backend 100% scriptable. Which I think is something most admins want.

-- GitLab Migration Automatic Message --
This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.
You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/polkit/polkit/issues/12.